Remote Access for Construction Site Networks Without a Static IP

Construction sites are some of the hardest networks to support remotely. A job-site trailer gets a router, a cellular modem, a handful of cameras, a time-and-attendance terminal, maybe a PLC or an environmental sensor, and then the whole thing moves to the next site in six months. There is no fixed line, no on-site IT, and no static IP. When a camera drops or the site Wi-Fi stops handing out addresses, someone has to drive out. For an MSP managing a dozen active sites, that does not scale.

The reason these networks are hard to reach is not the devices. It is how they connect to the internet.

Why a Job Site Has No Way In

Almost every temporary site runs on cellular. A 4G or 5G router such as a Teltonika RUT or a MikroTik with an LTE modem brings the trailer online in minutes, which is exactly why they are everywhere on construction sites. The catch is that mobile carriers put those connections behind carrier-grade NAT (CGNAT). The router never gets a public IP of its own; it shares one with thousands of other subscribers. Starlink, increasingly common on remote sites with no cell coverage, does the same thing.

CGNAT breaks the traditional remote-access playbook completely. You cannot forward a port to a device, because there is no public IP to forward from. You cannot stand up inbound VPN on the site router for the same reason. Dynamic DNS does not help, because the address it points at is not yours to reach. The connection only works in one direction: out.

One Outbound Tunnel Per Site

ProxyLink works with that constraint instead of against it. You run a single WireGuard tunnel on the site router, and the router dials out to ProxyLink's server. Because the handshake is outbound, CGNAT, a missing static IP, and a locked-down carrier firewall are all irrelevant. Nothing needs to be forwarded and nothing needs to be opened.

That one tunnel covers the entire site network, not a single device. The main LAN, a separate camera VLAN, and a sensor or office VLAN can all sit behind the same peer. You declare each subnet once, and the server can then route to any IP on any of them. No software is installed on the cameras, the time clock, the PLC, or the office PCs. They do not even need to know the tunnel exists.

What You Reach From a Browser

Once the tunnel is up, every device on the site gets its own link in the dashboard, and you open it from a browser:

• HTTP and HTTPS links for camera and NVR web interfaces, router admin pages, and sensor dashboards, on any port
• Browser RDP and VNC for the site office PC or a Windows machine in the trailer, with no client software on your laptop
• Browser SSH for the router itself, a Linux box, or networking gear
• TCP and UDP links for raw RTSP camera streams and other direct protocols

For the people who are not your engineers (a site manager who wants to check a camera, a subcontractor who needs ten minutes on one panel), a shareable access link opens a single device in a browser with no ProxyLink account at all. When the project ends, you revoke the tunnel and the whole site goes dark again.

Security on a Site You Do Not Control

A construction site is a shared, physically open environment, so the network should give away as little as possible. With ProxyLink the devices have no public IP and no open ports: they are reachable only through the tunnel, behind your authenticated login. Traffic runs over open-protocol WireGuard to a single server in Germany (Hetzner), with no third-party routing in the path. Each account and team is isolated at the firewall with its own ipset, so one client's site can never reach another's through the server. Paid plans add a per-session audit log and optional session recording per link, useful when more than one trade is touching the same system.

When the next site comes online, you deploy the same way: one router, one tunnel, every device reachable from a browser. Nothing to forward, no static IP to buy, nothing installed on the devices. Try ProxyLink free during early access, no card and no trial countdown. After early access, the MSP plan is 69 euro per month for 300 tunnels and 1,000 links, locked in for life for anyone who signs up now. Setup guides for MikroTik, pfSense, OPNsense, and OpenWRT are in the docs. Related: remote access over Starlink and CGNAT and Teltonika RUT remote access.